launchctl
launchctl can be used to load, start, stop, and unload macOS services. It is a command-line frontend to launchd.
Author: Josh Carullo Created: 2023-05-27
Paths
/bin/launchctl Example Use Cases
Use launchctl to execute an application
A oneliner that will load a plist as a LaunchAgent or LaunchDaemon, achieving persistence on a target machine. This command requires root privileges.
sudo launchctl load /Library/LaunchAgent/com.apple.installerPersistent launch agent
Creation of a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist
launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plistDetections
- LaunchAgents and LaunchDaemons must have a plist file on disk in the root, system, or user Library directory. Monitoring for plist's with executables located in /tmp or /Shared could identify suspicious applications.
- Jamf Protect: Detect launchctl activity that unloads or bootsout specific service